Okta IWA Desktop Single Sign On Fails on First Attempt in Chrome or Safari

When the Integrated Windows Authentication (IWA) server has HTTP/2 enabled, Chrome and Safari users experience a login failure on their first IWA authentication attempt. Specifically, Okta does not automatically sign in users on the first attempt in an IWA environment, but closing and reopening the browser allows a successful login. Disabling HTTP/2 in the Windows Registry resolves this issue.

• Okta Classic Engine
• Integrated Windows Authentication (IWA)
• Google Chrome
• Apple Safari

The IWA server has HTTP/2 enabled.

What steps resolve the Integrated Windows Authentication login failure?

Disable HTTP/2 on the IWA server by adding two new registry values in the Windows Registry Editor and rebooting the server.

1. Open the Windows Registry Editor on the IWA server.
2. Navigate to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters registry key.
3. Add two new REG_DWORD values to this registry key: EnableHttp2Tls and EnableHttp2Cleartext.
4. Set both values to 0.
5. Reboot the server.

Review the following image for an example of the configured Windows Registry Editor.